[quality] Shell scripts and Python hooks have zero unit test coverage

[kubestellar-hive]

Quality Improvement Epic — projectbluefin/common

This epic tracks the systematic improvement of test coverage and static analysis across all shell scripts and Python hooks shipped in the Bluefin common layer.

Background

An architectural review (2026-06-10) identified that the repo grew a test harness around libsetup.sh incrementally but never established a testing contract for new code. The result: security-critical and user-facing scripts accumulated with zero test coverage. This epic closed that gap.

Full analysis: docs/quality/ARCHITECTURE-REVIEW.md

---

Work Completed

PR	What shipped	Status
#540	20 pytest tests for hooks.py + 18 bats tests for libsetup.sh + setup scripts + CI workflow	✅ Merged
#554	Shellcheck expanded from 1 → 11 scripts + 3 profile.d fixes	✅ Merged
#568	27 new bats tests (bling / privileged-setup / luks-tpm2) + docs/TESTING.md + 80% coverage gate	✅ Merged
#573	bats tests for rechunker-group-fix, ublue-bling-fastfetch, changelog.just + --cov-fail-under=80	🟡 Awaiting review
#579	bats tests for ublue-fastfetch (8 tests) + CI wiring	🟡 Awaiting review
#580	Fix changelog bats CI failure (IMAGE_INFO_FILE override)	🟡 Awaiting review (fixes #573 CI)
docs push (2026-06-10)	TESTING.md: remove stale open.sh exemption, add ublue-motd + image-info exemptions, fix coverage target	✅ On main

---

Acceptance Criteria

• shellcheck covers all .sh + usr/bin scripts in system_files/
• All scripts in system_files/shared/usr/bin/ with branching logic have bats coverage or documented exemption
  • ublue-privileged-setup — PR feat(testing): expand shellcheck + add bats #568
  • ublue-bling — PR feat(testing): expand shellcheck + add bats #568
  • luks-tpm2-autounlock — PR feat(testing): expand shellcheck + add bats #568
  • rechunker-group-fix — PR test(quality): bats tests for rechunker-group-fix, ublue-bling-fastfetch, changelog.just + coverage gate #573
  • ublue-bling-fastfetch — PR test(quality): bats tests for rechunker-group-fix, ublue-bling-fastfetch, changelog.just + coverage gate #573
  • ublue-fastfetch — PR test(quality): add bats coverage for ublue-fastfetch, wire into CI #579
  • ublue-motd — documented exemption in TESTING.md (display-only wrapper)
  • ublue-image-info.sh — documented exemption in TESTING.md (read-only reporting)
  • ujust — 2-line passthrough, no logic
• Coverage threshold gate (--cov-fail-under=80) active in CI — PR feat(testing): expand shellcheck + add bats #568 + test(quality): bats tests for rechunker-group-fix, ublue-bling-fastfetch, changelog.just + coverage gate #573
• docs/TESTING.md exists with testing contract — PR feat(testing): expand shellcheck + add bats #568
• ublue-rollback-helper — ghost issue; script removed in PR fix(just): remove rebase-helper and ublue-rollback-helper #567. Issues [quality] ublue-rollback-helper has zero behavior tests #559, [quality] ublue-rollback-helper complex branching logic untested #564 closed.

Child Issues (closed)

• [quality] Expand shellcheck CI to cover all 11 shell scripts in system_files/ #552 Expand shellcheck CI — MERGED PR fix(ci): expand shellcheck to all shell scripts in system_files/ #554
• [quality] Add bats tests for ublue-privileged-setup #562 Add bats tests for ublue-privileged-setup — MERGED PR feat(testing): expand shellcheck + add bats #568
• [quality] ublue-bling shell config injection has no behavior tests #558 ublue-bling shell config injection tests — MERGED PR feat(testing): expand shellcheck + add bats #568
• [quality] luks-tpm2-autounlock has no test coverage for security-critical disk encryption logic #565 luks-tpm2-autounlock tests — MERGED PR feat(testing): expand shellcheck + add bats #568
• [quality] Add coverage reporting and threshold gate to common repo CI #561 Add coverage reporting and threshold gate — MERGED PR feat(testing): expand shellcheck + add bats #568
• [quality] rechunker-group-fix and ublue-bling-fastfetch missing bats tests #571 rechunker-group-fix and ublue-bling-fastfetch tests — addressed in PR test(quality): bats tests for rechunker-group-fix, ublue-bling-fastfetch, changelog.just + coverage gate #573
• [quality] changelog.just: new lts/bluefin repo-selection logic needs bats test #572 changelog.just repo-selection tests — addressed in PR test(quality): bats tests for rechunker-group-fix, ublue-bling-fastfetch, changelog.just + coverage gate #573
• [quality] ublue-rollback-helper has zero behavior tests #559, [quality] ublue-rollback-helper complex branching logic untested #564 ublue-rollback-helper ghost issues — CLOSED (script doesn't exist)
• [quality] Add shellcheck CI and bats tests for libsetup.sh and shell scripts #551, [quality] ublue-privileged-setup lacks unit tests despite running with elevated privileges #563, [quality] Add coverage reporting and regression detection to unit-tests workflow #566 — CLOSED (duplicates / partially resolved)

[castrojo]

All acceptance criteria met. PRs #540, #554, #568, #573, #579 merged. #580 closed as superseded. Epic complete.